Those who think I'm joking, at the time of posting this, the UCC website (Wordpress) is using the following plugins versions: Elementor Pro 3.14.1 unless updated but has this CVE-2026-32475 vulnerability that lets someone who isn’t logged in upload a file and run code on the server. It is rated 9.8 Ultimate Addons for Elementor 1.36.19 with two high-severity (8.8) flaws that let a user give themselves more access: CVE-2023-50890 affecting versions ≤1.36.20 and CVE-2024-37455 (≤1.36.31). Fluent Forms 5.2.9. It’s affected by many bugs including a 7.2-rated flaw that lets visitors who aren’t logged in plant malicious scripts (≤6.2.11), IP-spoofing bug (≤5.2.12). Custom Twitter Feeds 2.2.5. A 7.2-rated flaw lets visitors who aren’t logged in plant malicious scripts in versions up to 2.5.4; it’s fixed in 2.5.5 but UCC is at 2.2.5 Elementor Custom Skin 3.1.9. Versions before 4.3.8 let visitors who aren’t logged in see private content. One Click Accessibility. This plugin is now called Ally. Ally ≤4.0.3 has a SQL injection flaw that works without logging in. I found these in just less than 20 minutes of research, imagine what a hacker can find in months of trying to break in. Wordpress isn't the problem, the issue is installing plugins left and right. Most plugins have flaws discovered almost every month and it becomes a race.